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DETAILED ACTION 

The Request for Continued Examination has been entered and accepted. 

Response to Arguments 

Applicant's arguments, filed 6/09/2008, with respect to USC 1 12, and 37 CFR 1.131 
have been fully considered and are persuasive. The rejection in view of Sung US 2004/0215972 
has been withdrawn. 

Claim Rejections - 35 USC §103 
The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A palcnl may nol be oblaincd Ihough the invention is not identically disclosed or described as set Ibrth in 
section 102 of this title, if the differences between the subject matter sought to be patented and the prior art are 
such that the subject matter as a whole would have been obvious at the time the invention was made to a person 
having ordinary skill in the art to which said subject matter pertains. Patentability shall not be negatived by the 
manner in which the invention was made. 

Claims rejected under 35 U.S.C. 103(a) as being unpatentable over Whelan US 
2004/0003285. 

As per claims 1 , and 30, Whelan teaches establishing signal transfer policies for each of 
a plurality of interconnection devices of the network system (prevent network traffic flow fi-om 
certain access points) [0039]. Whelan teaches monitoring the network for intrusions (determines 
whether authorized) [0036]. Whelan teaches changing one or more signal transfer policies of 
one or more of the plurality of interconnection devices in response to the one or more detected 
intrusions (if unauthorized disables or reroutes communications [0039].. 
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Whalen teaches excluding a policy enforcement module for effecting its own signal 
transfer policy changes via the fact that the instructions for change originate with the network 
monitor. 

As per claims 2, and 3 Whalen teaches identifying one or more sources of the intrusion s 
including the physical or logical address (rouge access point) [0036]. 

As per claim 5,38 Whelan teaches employing an IDS (network monitor) [0024]. 

As per claim 8 Whelan teaches identifying one or more of the plurality of devices 
associated with the one or more sources of the intrusion including determining the addresses of 
the devices (reroutes other network devices to prevent traffic from rouge element) [0039]. 

As per claim 9, 29, 41 Whelan teaches verifying the identification of the source 
(verification of rouge access point) [0038]. 

As per claim 10, Whelan teaches the device to block access [0039]. 

As per claims 12, and 13 Whelan teaches configuring a first set of network devices with 
policy and after an intrusion configuring a second set of policy (normal behavior until an 
intrusion, and then blocking access) [0039]. 
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As per claim 14, 39 Whelan, teaches the device is a network entry device (access points 
connected to rouge mobile units) [0046]. 

As per claim 15, Whelan teaches configuring ports [0039], [0041]. 

As per claim 28, 40 Whelan teaches identifying the address of both the source and the 
network entry device (send instructions to the device to block the address of the source) [0047]. 

As per claim 33 Whelan teaches a directory service function for receiving address 
information (checks tables) [0034]. 

As per claim 34 Whelan teaches a policy manager function to configure devices [0039] 

As per claim 35 Whelan teaches utilizing the directory service to evaluate whether a 
policy change is required [0036]. 

As per claim 36, 37 Whelan teaches the system is centralized network monitor [001 1] 

Claims rejected under 35 U.S.C. 103(a) as being unpatentable over Whelan US 
2004/0003285 in view of Goldman US 2003/0046583 
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As per claims 4, and 32, Goldman teaches configuring devices to be capable of changing 
their own transfer policies (detect intrusion and block) [003] [ 003 1] . It would have been 
obvious to one of ordinary skill in the art to use the configuration of Goldman because it allows a 
quicker response to an intrusion detection. 

Claims rejected under 35 U.S.C. 103(a) as being unpatentable over Wlielan US 
2004/0003285 in view of Baffes US 2004/0111636 

As per claim 11, Whelan does not teach allowing activity and collecting forensic 

evidence. 

Baffes teaches allowing an intrusion to a honeypot in order to collect forensics evidence 
[0038]. It would have been obvious to one of ordinary skill in the art to use the method of Baffes 
in the system of Whelan in order to fiirther investigate the source of intrusions. 

Conclusion 

Any inquiry concerning this communication or earlier communications fi-om the 
examiner should be directed to CHRISTOPHER J. BROWN whose telephone number is 
(571)272-3833. The examiner can normally be reached on 8:30-6:00. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Kambiz Zand can be reached on (571)272-381 1. The fax phone number for the 
organization where this application or proceeding is assigned is 571-273-8300. 
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Information regarding the status of an application may be obtained from the Patent 
Application Information Retrieval (PAIR) system. Status information for published applications 
may be obtained from either Private PAIR or Public PAIR. Status information for unpublished 
applications is available through Private PAIR only. For more information about the PAIR 
system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR 
system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would 
like assistance from a USPTO Customer Service Representative or access to the automated 
information system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. 

/Christopher J Brown/ 8/23/08 
Primary Examiner, Art Unit 2134 



